Strange problem with applying securityContext.appArmorProfile.type on pod/container level

General Discussions
1

Hi folks! I stumbled upon strange problem with applying securityContext.appArmorProfile.type on pod/container level, either when creating pod directly, or by Deployment/Daemonset/Statefullset.

When i’m applying manifest

apiVersion: v1
kind: Pod
metadata:
  name: hello-apparmor
#  annotations:
#    container.apparmor.security.beta.kubernetes.io/hello: unconfined
spec:
  securityContext:
    appArmorProfile:
      type: Unconfined
  containers:
  - name: hello
    image: busybox:1.28
    command: [ "sh", "-c", "echo 'Hello AppArmor!' && sleep 1h" ]
    securityContext:
      appArmorProfile:
        type: Unconfined

the pod created have

spec:
  containers:
    - name: hello
      securityContext: {}
  securityContext: {}

but when the manifest have

metadata:
  name: hello-apparmor
  annotations:
    container.apparmor.security.beta.kubernetes.io/hello: unconfined

the pod created have

spec:
  containers:
    - name: hello
      securityContext:
        appArmorProfile:
          type: Unconfined
  securityContext: {}

What i’ve double checked

  • there’s no interfering validating/mutating webhooks
  • no Pod Security Standard explicitly applied on the target namespace

Moreover, i have ± similar cluster, with the same set of software and same versions, which works like a champ.

Please dear colleagues, would be very grateful fresh ideas / troubleshooting scenarios / insights.

Br, Alexey

Cluster information:

Kubernetes version: v1.32.5+rke2r1
Cloud being used: bare-metal
Installation method: rke2
Host OS: Ubuntu 24.04.1 LTS
CNI and version: cilium v1.17.4
CRI and version: containerd v2.0.5-k3s1